CVE-2026-98510
Received Received - Intake

NULL Pointer Dereference in Linux Kernel DRM/XE VM

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xe_vm_close_and_put(), external-BO VMAs are queued on the contested list for deferred destruction via xe_vma_destroy_unlocked(). However, xe_vm_pt_destroy() was previously invoked before processing contested VMAs, destroying vm->pt_root while those VMAs were still linked to their respective buffer objects (vm_bo->list.gpuva). If a concurrent thread evicts one of those shared buffer objects, xe_bo_trigger_rebind() holding only bo->resv walks the BO's VMAs and, in fault mode, calls xe_vm_invalidate_vma() -> xe_pt_zap_ptes(). Because vm->pt_root[tile->id] is already NULL, dereferencing pt->level causes a NULL ptr deref. Fix this by deferring xe_vm_free_scratch() and xe_vm_pt_destroy() until after all contested VMAs have been unlinked and destroyed. User is reporting hitting a NULL ptr deref in xe_pt_zap_ptes(), which could be explained by this race. (cherry picked from commit c2863648959489767f08892fd6e90577d2ea0b6a)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98510
EUVD
EUVD-2026-103750

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux b06d47be7c83165d3b3e45e1d5f9520b79c7f5cc
Linux Linux b06d47be7c83165d3b3e45e1d5f9520b79c7f5cc
Linux Linux b06d47be7c83165d3b3e45e1d5f9520b79c7f5cc
Linux Linux b06d47be7c83165d3b3e45e1d5f9520b79c7f5cc
Linux Linux 6.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's drm/xe/vm component. It occurs when page tables are destroyed before contested virtual memory areas (VMAs) are unlinked, causing a race condition where a concurrent thread may try to access already freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's DRM/XE driver and may not have direct network detection methods. Monitor kernel logs for NULL pointer dereference errors in xe_pt_zap_ptes() or related DRM/XE functions. Check for crashes in graphics-related processes or Xorg logs.

Impact Analysis

This vulnerability can cause system crashes due to NULL pointer dereferences. Users may experience kernel panics, application failures, or unexpected system reboots when specific graphics operations are performed concurrently.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling the DRM/XE driver or restricting access to graphics-intensive operations until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98510. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart